50f433b0cdb16eea550fe1f26edf370e29beb0f6e23b6d724ed0ac6de5029beb

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 14:53 UTC

Target

092ad769a0f62647db85ae5fc01d3530_JaffaCakes118.exe
Size

71KB
MD5

092ad769a0f62647db85ae5fc01d3530
SHA1

fea1f57627f1d70560a7337238aef2e463efaf16
SHA256

50f433b0cdb16eea550fe1f26edf370e29beb0f6e23b6d724ed0ac6de5029beb
SHA512

f4fa0e91132ec4a1f0dd4ecde33d193112f43e4f54982f4c19f581d5a99b0684c09d529443fd1a09b50aab3379ca926ef5aa26750444cbce64e0f8f29800d1d7
SSDEEP

1536:74wXw9yokzDexLoB8wmoNySArJso5LPzU8UhU3N:74wXw9jkzKd5oASA/5LPAnm3N

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2940	2944	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2940	2944	092ad769a0f62647db85ae5fc01d3530_JaffaCakes118.exe	28
PID 2944 wrote to memory of 2940	2944	092ad769a0f62647db85ae5fc01d3530_JaffaCakes118.exe	28
PID 2944 wrote to memory of 2940	2944	092ad769a0f62647db85ae5fc01d3530_JaffaCakes118.exe	28
PID 2944 wrote to memory of 2940	2944	092ad769a0f62647db85ae5fc01d3530_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\092ad769a0f62647db85ae5fc01d3530_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\092ad769a0f62647db85ae5fc01d3530_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 136
  2⤵
  - Program crash
  PID:2940

memory/2944-0-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2944-1-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download